Example Analysis of repairing High-risk vulnerabilities of license Bypass with Apache Shiro 1.6.0

This article will explain in detail the example analysis of Apache Shiro 1.6.0 repair to bypass authorization high-risk vulnerabilities. The content of the article is of high quality, so the editor shares it for you as a reference. I hope you will have some understanding of the relevant knowledge after reading this article.

Apache Shiro is a powerful and easy-to-use Java security framework that performs authentication, authorization, password, and session management. With Shiro's easy-to-understand API, you can quickly and easily access any application, from the smallest mobile application to the largest network and enterprise application.

Update log

The filter chain is not parsed correctly.

Base64 tool class # decode. Abnormal

Add support for global filter

Update dependency

CVE-2020-13933 security vulnerability

There is a flaw in the fix for CVE-2020-11989 (security vulnerability of 2020.6). Due to the difference between shiro and spring in handling url and an error in handling authentication requests, authentication bypass vulnerabilities still exist, and remote attackers can send specially crafted HTTP requests, bypass the authentication process and gain unauthorized access to the application.

Apache Shiro

< 1.6.0 都会有此问题 ，请大家及时升级 org.apache.shirogroupId>

Shiro-allartifactId >

1.6.0version >

Pomtype >

Dependency > this is the end of the example analysis of Apache Shiro 1.6.0 repairing high-risk vulnerabilities to bypass authorization. I hope the above content can be helpful to you and learn more. If you think the article is good, you can share it for more people to see.